Notarization
Overview
Notarization is the malware scanning service Apple provides for macOS apps distributed outside the App Store. Developers submit their apps to Apple as part of the distribution process. Apple scans the developer’s software for known malware and, if none is found, issues a Notarization ticket. Developers staple this ticket to the app so Gatekeeper can verify and launch it, including offline.
Notarization is also the method to block a previously trusted app if it’s later found to be malicious. Apple issues a revocation ticket, a small record referencing the app’s cryptographic hash. Apple distributes revocation tickets via CloudKit much more frequently than XProtect can ship a new signature. The original Notarization ticket stays stapled to the app; the revocation ticket adds a separate record that Gatekeeper consults at launch and that overrides the notarization. This lets Apple block a malicious app without pushing a software update, even if the device is offline at the time of launch.
Reported behavior
Users may report an app they had been using opens normally one day and stops opening the next, with macOS displaying an alert that the app contains malware. Or a freshly downloaded app may refuse to open, with macOS indicating it couldn’t verify the app is free of malware. These patterns point to distinct conditions, and the dialog text tells you which condition applies.
Isolating the issue
Match the dialog text the user describes against the following:
Title “Malware Blocked”, body “(App) was not opened because it contains malware. This action did not harm your Mac.” Apple has identified the app as malicious. This dialog appears when a Notarization revocation ticket has been issued for the app, when XProtect signatures match the app, or both. This indicates malware, and isn’t a Gatekeeper warning to bypass.
Title “(App) Not Opened”, body “Apple could not verify (App) is free of malware that may harm your Mac or compromise your privacy.” macOS couldn’t validate the app, either because the app isn’t notarized or because its signature doesn’t match its current contents (incomplete download, modification after signing, or corruption). The dialog’s primary action is Move to Trash and doesn’t offer an Open option. See Troubleshooting for the verification steps that distinguish these causes.
Troubleshooting
When the dialog identifies the app as malicious, click Move to Trash, then download a new copy. If the new copy also fails to launch, Apple has either revoked the app’s notarization or matched the file against XProtect signatures. Either way, the identification is positive; don’t attempt to bypass.
When the dialog reports that Apple couldn’t verify the app, the cause may be that the app isn’t notarized or that its signature is broken. Run spctl --assess and codesign --verify against the app to determine which:
If
spctl --assessreturnsrejectedandcodesign --verifysucceeds, the app is intact but not notarized. On an unmanaged Mac the user can choose to open it intentionally if they trust the source. Confirm the source is legitimate before recommending this. On a managed Mac, a device management policy may prevent override, in which case the app must be approved through the organization’s normal app-approval channel.If
codesign --verifyreports a signature failure, the app’s contents don’t match its signature. The most common benign cause is an incomplete download. Have the user download a fresh copy from the original source. If the fresh copy also fails verification, treat the app as compromised and don’t attempt to bypass.If
spctl --assessreturnsaccepted, the source of the block isn’t Notarization or Gatekeeper. See Managed environments.
Verify Notarization status of an app
Use the spctl (SecAssessment system policy security) command-line utility to check the status of a notarized app:
In Finder, choose Go > Utilities, then open the Terminal app.
Type
spctl --assess --type execute -v /Applications/AppName.appPress Return.
If the app you check with spctl is from the Mac App Store, the results will be:
<app name>: acceptedsource=Mac App Store
Note: All apps from the Mac App Store are code signed and trusted, and don’t require Notarization.
If the app you check with spctl is from a download and Notarized, the results will be:
<app name>: acceptedsource=Notarized Developer ID
If the app you check with spctl is from a download and isn’t Notarized, the results will be:
<app name>: rejected
Managed environments
On a Mac enrolled in device management, configuration profile policy can prevent users from overriding Gatekeeper warnings in System Settings. When this policy is in effect, the user can’t open an app that isn’t notarized, even if they could otherwise open it on an unmanaged Mac; instead, they need to request approval through the organization’s normal app-approval channel.
Endpoint security agents and device management commands can also intercept app launches before Gatekeeper evaluates them, producing dialogs or notifications from the management layer rather than from Notarization. If spctl --assess returns accepted for a blocked app, the source is one of these layers. Consult the documentation for your device management service and endpoint security agent to troubleshoot further.